Skip to content

Commit 6feda75

Browse files
ARichman555ARichman555
committed
Update e2e tests to be partitional
Signed-off-by: Alex Richman <[email protected]>
1 parent 9c057ee commit 6feda75

File tree

3 files changed

+44
-21
lines changed

3 files changed

+44
-21
lines changed

‎e2e/aws_helpers.go‎

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"time"
99

1010
"github.com/aws/aws-sdk-go-v2/aws"
11+
"github.com/aws/aws-sdk-go-v2/aws/arn"
1112
"github.com/aws/aws-sdk-go-v2/config"
1213
"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
1314
"github.com/aws/aws-sdk-go-v2/service/acmpca"
@@ -150,8 +151,9 @@ func deleteAccessKey(ctx context.Context, cfg aws.Config, userName string, acces
150151
}
151152
}
152153

153-
func deleteCertificateAuthority(ctx context.Context, cfg aws.Config, caArn string) {
154+
func (testCtx *TestContext) deleteCertificateAuthority(ctx context.Context, cfg aws.Config, name string) {
154155
pcaClient := acmpca.NewFromConfig(cfg)
156+
caArn := testContext.caArns[name]
155157

156158
updateCAParams := acmpca.UpdateCertificateAuthorityInput{
157159
CertificateAuthorityArn: &caArn,
@@ -175,20 +177,21 @@ func deleteCertificateAuthority(ctx context.Context, cfg aws.Config, caArn strin
175177
panic(deleteErr.Error())
176178
}
177179

180+
delete(testContext.caArns, name)
178181
}
179182

180-
func createCertificateAuthority(ctx context.Context, cfg aws.Config, isRSA bool) string {
183+
func (testCtx *TestContext) createCertificateAuthority(ctx context.Context, cfg aws.Config, name string, signingAlgorithm types.SigningAlgorithm) {
181184
pcaClient := acmpca.NewFromConfig(cfg)
182185

183-
var signingAlgorithm types.SigningAlgorithm
184186
var keyAlgorithm types.KeyAlgorithm
185187

186-
if isRSA {
187-
signingAlgorithm = types.SigningAlgorithmSha256withrsa
188+
switch signingAlgorithm {
189+
case types.SigningAlgorithmSha256withrsa:
188190
keyAlgorithm = types.KeyAlgorithmRsa2048
189-
} else {
190-
signingAlgorithm = types.SigningAlgorithmSha256withecdsa
191+
case types.SigningAlgorithmSha256withecdsa:
191192
keyAlgorithm = types.KeyAlgorithmEcPrime256v1
193+
default:
194+
panic("Unknown signing algorithm: " + signingAlgorithm)
192195
}
193196

194197
commonName := "CMTest-" + strconv.FormatInt(time.Now().Unix(), 10)
@@ -211,6 +214,7 @@ func createCertificateAuthority(ctx context.Context, cfg aws.Config, isRSA bool)
211214
}
212215

213216
caArn := createOutput.CertificateAuthorityArn
217+
testCtx.caArns[name] = *caArn
214218

215219
getCsrParams := acmpca.GetCertificateAuthorityCsrInput{
216220
CertificateAuthorityArn: caArn,
@@ -235,7 +239,7 @@ func createCertificateAuthority(ctx context.Context, cfg aws.Config, isRSA bool)
235239
CertificateAuthorityArn: caArn,
236240
Csr: []byte(*caCsr),
237241
SigningAlgorithm: signingAlgorithm,
238-
TemplateArn: aws.String("arn:aws:acm-pca:::template/RootCACertificate/V1"),
242+
TemplateArn: aws.String("arn:" + testCtx.partition + ":acm-pca:::template/RootCACertificate/V1"),
239243
Validity: &types.Validity{
240244
Type: types.ValidityPeriodTypeDays,
241245
Value: aws.Int64(365),
@@ -279,8 +283,6 @@ func createCertificateAuthority(ctx context.Context, cfg aws.Config, isRSA bool)
279283
if importCertErr != nil {
280284
panic(importCertErr.Error())
281285
}
282-
283-
return *caArn
284286
}
285287

286288
func getAccountID(ctx context.Context, cfg aws.Config) string {
@@ -295,6 +297,23 @@ func getAccountID(ctx context.Context, cfg aws.Config) string {
295297
return *callerID.Account
296298
}
297299

300+
func getPartition(ctx context.Context, cfg aws.Config) string {
301+
stsClient := sts.NewFromConfig(cfg)
302+
303+
callerID, callerErr := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
304+
305+
if callerErr != nil {
306+
panic(callerErr.Error())
307+
}
308+
309+
parsedArn, parseErr := arn.Parse(*callerID.Arn)
310+
if parseErr != nil {
311+
return "aws"
312+
}
313+
314+
return parsedArn.Partition
315+
}
316+
298317
func assumeRole(ctx context.Context, cfg aws.Config, roleName string, region string) aws.Config {
299318

300319
stsClient := sts.NewFromConfig(cfg)

‎e2e/awspcaissuer_test.go‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111

1212
"github.com/aws/aws-sdk-go-v2/aws"
1313
"github.com/aws/aws-sdk-go-v2/config"
14+
"github.com/aws/aws-sdk-go-v2/service/acmpca/types"
1415
"github.com/cert-manager/aws-privateca-issuer/pkg/api/v1beta1"
1516
clientV1beta1 "github.com/cert-manager/aws-privateca-issuer/pkg/clientset/v1beta1"
1617
cmclientv1 "github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1"
@@ -31,7 +32,7 @@ type TestContext struct {
3132
xaCfg aws.Config
3233
caArns map[string]string
3334

34-
region, accessKey, secretKey, endEntityResourceShareArn, subordinateCaResourceShareArn, userName, policyArn string
35+
region, partition, accessKey, secretKey, endEntityResourceShareArn, subordinateCaResourceShareArn, userName, policyArn string
3536
}
3637

3738
// These are variables specific to each test
@@ -111,6 +112,8 @@ func InitializeTestSuite(suiteCtx *godog.TestSuiteContext) {
111112
panic(cfgErr.Error())
112113
}
113114

115+
testContext.partition = getPartition(ctx, cfg)
116+
114117
testContext.iclient, err = clientV1beta1.NewForConfig(clientConfig)
115118

116119
if err != nil {
@@ -124,22 +127,22 @@ func InitializeTestSuite(suiteCtx *godog.TestSuiteContext) {
124127
}
125128

126129
// Create CAs to be used in testing
127-
testContext.caArns["RSA"] = createCertificateAuthority(ctx, cfg, true)
130+
testContext.createCertificateAuthority(ctx, cfg, "RSA", types.SigningAlgorithmSha256withrsa)
128131
log.Printf("Created RSA CA with arn %s", testContext.caArns["RSA"])
129132

130-
testContext.caArns["ECDSA"] = createCertificateAuthority(ctx, cfg, false)
133+
testContext.createCertificateAuthority(ctx, cfg, "ECDSA", types.SigningAlgorithmSha256withecdsa)
131134
log.Printf("Created EC CA with arn %s", testContext.caArns["ECDSA"])
132135

133136
xaRole, xaRoleExists := os.LookupEnv(CrossAccountRoleKey)
134137
if xaRoleExists {
135138
testContext.xaCfg = assumeRole(ctx, cfg, xaRole, testContext.region)
136139

137-
testContext.caArns["XA"] = createCertificateAuthority(ctx, testContext.xaCfg, true)
140+
testContext.createCertificateAuthority(ctx, testContext.xaCfg, "XA", types.SigningAlgorithmSha256withrsa)
138141

139142
log.Printf("Created XA CA with arn %s", testContext.caArns["XA"])
140143

141-
endEntityResourcePermission := "arn:aws:ram::aws:permission/AWSRAMDefaultPermissionCertificateAuthority"
142-
subordinateCaResourcePermission := "arn:aws:ram::aws:permission/AWSRAMSubordinateCACertificatePathLen0IssuanceCertificateAuthority"
144+
endEntityResourcePermission := "arn:" + testContext.partition + ":ram::aws:permission/AWSRAMDefaultPermissionCertificateAuthority"
145+
subordinateCaResourcePermission := "arn:" + testContext.partition + ":ram::aws:permission/AWSRAMSubordinateCACertificatePathLen0IssuanceCertificateAuthority"
143146

144147
testContext.endEntityResourceShareArn = shareCA(ctx, cfg, testContext.xaCfg, testContext.caArns["XA"], endEntityResourcePermission)
145148
testContext.subordinateCaResourceShareArn = shareCA(ctx, cfg, testContext.xaCfg, testContext.caArns["XA"], subordinateCaResourcePermission)
@@ -174,10 +177,10 @@ func InitializeTestSuite(suiteCtx *godog.TestSuiteContext) {
174177
panic(cfgErr.Error())
175178
}
176179

177-
deleteCertificateAuthority(ctx, cfg, testContext.caArns["RSA"])
180+
testContext.deleteCertificateAuthority(ctx, cfg, "RSA")
178181
log.Printf("Deleted the RSA CA")
179182

180-
deleteCertificateAuthority(ctx, cfg, testContext.caArns["ECDSA"])
183+
testContext.deleteCertificateAuthority(ctx, cfg, "ECDSA")
181184
log.Printf("Deleted the EC CA")
182185

183186
deleteAccessKey(ctx, cfg, testContext.userName, testContext.accessKey)
@@ -198,7 +201,7 @@ func InitializeTestSuite(suiteCtx *godog.TestSuiteContext) {
198201
deleteResourceShare(ctx, testContext.xaCfg, testContext.subordinateCaResourceShareArn)
199202
log.Printf("Deleted resource shares associated with XA CA")
200203

201-
deleteCertificateAuthority(ctx, testContext.xaCfg, testContext.caArns["XA"])
204+
testContext.deleteCertificateAuthority(ctx, testContext.xaCfg, "XA")
202205
log.Printf("Deleted the XA CA")
203206
}
204207
})

‎e2e/blog_test.sh‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ set_variables() {
1717
export SECURITY_GROUP_ID=$(curl_with_token --silent http://169.254.169.254/latest/meta-data/network/interfaces/macs/${INTERFACE}/security-group-ids)
1818
export VPC_ID=$(curl_with_token --silent http://169.254.169.254/latest/meta-data/network/interfaces/macs/${INTERFACE}/vpc-id)
1919
export PORT=6443
20+
export AWS_PARTITION=$(aws sts get-caller-identity --query 'Arn' --output text | cut -d':' -f2)
2021
tag_subnet
2122
add_inbound_rule
2223
create_ca
@@ -39,7 +40,7 @@ create_target_group() {
3940

4041
LOAD_BALANCER_NAME=$(cut -d'.' -f1 <<<"$LOAD_BALANCER_HOSTNAME" | sed 's/\(.*\)-/\1\//')
4142

42-
LOAD_BALANCER_ARN=arn:aws:elasticloadbalancing:$AWS_REGION:$(aws sts get-caller-identity | jq -r ".Account"):loadbalancer/net/$LOAD_BALANCER_NAME
43+
LOAD_BALANCER_ARN=arn:${AWS_PARTITION}:elasticloadbalancing:$AWS_REGION:$(aws sts get-caller-identity | jq -r ".Account"):loadbalancer/net/$LOAD_BALANCER_NAME
4344

4445
LISTENER_ARN=$(aws elbv2 describe-listeners --load-balancer-arn $LOAD_BALANCER_ARN | jq -r ".Listeners[0].ListenerArn")
4546

@@ -55,7 +56,7 @@ create_ca() {
5556

5657
aws acm-pca get-certificate-authority-csr --certificate-authority-arn $CA_ARN --output text --region us-east-1 >$E2E_DIR/blog-test/ca.csr
5758

58-
CERTIFICATE_ARN=$(aws acm-pca issue-certificate --certificate-authority-arn $CA_ARN --csr fileb://$E2E_DIR/blog-test/ca.csr --signing-algorithm SHA256WITHRSA --template-arn arn:aws:acm-pca:::template/RootCACertificate/V1 --validity Value=365,Type=DAYS --query 'CertificateArn' --output text)
59+
CERTIFICATE_ARN=$(aws acm-pca issue-certificate --certificate-authority-arn $CA_ARN --csr fileb://$E2E_DIR/blog-test/ca.csr --signing-algorithm SHA256WITHRSA --template-arn arn:${AWS_PARTITION}:acm-pca:::template/RootCACertificate/V1 --validity Value=365,Type=DAYS --query 'CertificateArn' --output text)
5960

6061
aws acm-pca wait certificate-issued --certificate-authority-arn $CA_ARN --certificate-arn $CERTIFICATE_ARN
6162

0 commit comments

Comments
 (0)